frida 工具 objection 小细节

打开objection:

C:\Users\Administrator\Downloads>objection -g com.tencent.mobileqq explore
Using USB device `AOSP on angler`
Agent injected and responds ok!

     _   _         _   _
 ___| |_|_|___ ___| |_|_|___ ___
| . | . | | -_|  _|  _| | . |   |
|___|___| |___|___|_| |_|___|_|_|
      |___|(object)inject(ion) v1.8.4

     Runtime Mobile Exploration
        by: @leonjza from @sensepost

[tab] for command suggestions
com.tencent.mobileqq on (Android: 6.0.1) [usb] #

添加某个函数断点，并输出调用栈，入参和出参：

com.tencent.mobileqq on (Android: 6.0.1) [usb] # android hooking watch class_method com.android.okhttp.internal.http.Ht
tpEngine.hasBody --dump-args --dump-backtrace --dump-return
(agent) Attempting to watch class com.android.okhttp.internal.http.HttpEngine and method hasBody.
(agent) Hooking com.android.okhttp.internal.http.HttpEngine.hasBody(com.android.okhttp.Response)
(agent) Registering job 65vnl7pd22. Type: watch-method for: com.android.okhttp.internal.http.HttpEngine.hasBody
com.tencent.mobileqq on (Android: 6.0.1) [usb] #

查看某个类中所有函数的调用：

com.tencent.mobileqq on (Android: 6.0.1) [usb] # android hooking watch class com.tencent.mobileqq.highway.segment.HwReq
uest
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.checkCacheIp(com.tencent.mobileqq.highway.segment.HwResponse, com.tencent.mobileqq.highway.transaction.Transaction)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.dumpBaseInfo()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getExtendInfo()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getHwSeq()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getLoginSigHead()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getPriority()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getRequestBody()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getSegmentHead()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.getTicket()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.hasRequestBody()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onCancle()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onError(int)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onResponse(com.tencent.mobileqq.highway.segment.RequestWorker, com.tencent.mobileqq.highway.segment.HwResponse)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onResponse(com.tencent.mobileqq.highway.segment.RequestWorker, com.tencent.mobileqq.highway.segment.HwResponse, com.tencent.mobileqq.highway.segment.HwRequest)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onRetry(int)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onSendBegin()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.onSendEnd()
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.setHwSeq(int)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.updateStaus(int)
(agent) Hooking com.tencent.mobileqq.highway.segment.HwRequest.intToIP(int)
(agent) Registering job zgp81je8b9o. Type: watch-class for: com.tencent.mobileqq.highway.segment.HwRequest
com.tencent.mobileqq on (Android: 6.0.1) [usb] #

查看当前任务: 

com.tencent.mobileqq on (Android: 6.0.1) [usb] # jobs list
Job ID         Hooks  Type
-----------  -------  ---------------------------------------------------------------------
65vnl7pd22         1  watch-method for: com.android.okhttp.internal.http.HttpEngine.hasBody
zgp81je8b9o       20  watch-class for: com.tencent.mobileqq.highway.segment.HwRequest
com.tencent.mobileqq on (Android: 6.0.1) [usb] #

关闭某个断点：

com.tencent.mobileqq on (Android: 6.0.1) [usb] # jobs kill 65vnl7pd22

这里的job号，不仅可以通过jobs list获得，每次hook住之后，最左边也会携带，如下：

(agent) [iqbhfw0ezd] Called com.tencent.mobileqq.highway.segment.HwRequest.intToIP(int)
(agent) [iqbhfw0ezd] Called com.tencent.mobileqq.highway.segment.HwRequest.getHwSeq()
(agent) [iqbhfw0ezd] Called com.tencent.mobileqq.highway.segment.HwRequest.getHwSeq()

暂时就用到这些，以后再补